5

Many of the event descriptions for event log events are missing when I query them in powershell with Get-EventLog but they are present when I query them in powershell with Get-WinEvent or view them in the regular event viewer eventvwr.msc

Here's the output of Get-EventLog:

PS U:\> Get-EventLog -LogName System -Source Microsoft-Windows-Kernel-Power

   Index Time          EntryType   Source                 InstanceID Message
   ----- ----          ---------   ------                 ---------- -------
   11985 Apr 02 13:42  Information Microsoft-Windows...          172 The description for Event ID '172' in Source 'Microsoft-Windo...
   11968 Apr 02 13:41  Information Microsoft-Windows...          109 The description for Event ID '109' in Source 'Microsoft-Windo...
   11732 Apr 02 09:41  Information Microsoft-Windows...          172 The description for Event ID '172' in Source 'Microsoft-Windo...
   11714 Apr 02 09:40  Information Microsoft-Windows...          109 The description for Event ID '109' in Source 'Microsoft-Windo...
   10363 Mar 29 14:28  Information Microsoft-Windows...          172 The description for Event ID '172' in Source 'Microsoft-Windo...
   10346 Mar 29 14:28  Information Microsoft-Windows...          109 The description for Event ID '109' in Source 'Microsoft-Windo...

Here's a full event:

PS U:\> Get-EventLog -LogName System -Source Microsoft-Windows-Kernel-Power | select -first 1 | fl


Index              : 11985
EntryType          : Information
InstanceId         : 172
Message            : The description for Event ID '172' in Source 'Microsoft-Windows-Kernel-Power' cannot be found.  The local
                     computer may not have the necessary registry information or message DLL files to display the message, or you
                     may not have permission to access them.  The following information is part of the event:'2', '6'
Category           : (203)
CategoryNumber     : 203
ReplacementStrings : {2, 6}
Source             : Microsoft-Windows-Kernel-Power
TimeGenerated      : 2019-04-02 13:42:01
TimeWritten        : 2019-04-02 13:42:01
UserName           : NT AUTHORITY\SYSTEM

Here's the output from Get-WinEvent:

PS C:\WINDOWS\system32> Get-WinEvent -LogName System -FilterXPath "<QueryList>
>>   <Query Id='0' Path='System'>
>>     <Select Path='System'>*[System[Provider[@Name='Microsoft-Windows-Kernel-Power']]]</Select>
>>   </Query>
>> </QueryList>"


   ProviderName: Microsoft-Windows-Kernel-Power

TimeCreated                     Id LevelDisplayName Message
-----------                     -- ---------------- -------
2019-04-02 13:42:01            172 Information      Connectivity state in standby: Disconnected, Reason: NIC compliance
2019-04-02 13:41:44            109 Information      The kernel power manager has initiated a shutdown transition....
2019-04-02 09:41:08            172 Information      Connectivity state in standby: Disconnected, Reason: NIC compliance
2019-04-02 09:40:51            109 Information      The kernel power manager has initiated a shutdown transition....
2019-03-29 14:28:26            172 Information      Connectivity state in standby: Disconnected, Reason: NIC compliance
2019-03-29 14:28:09            109 Information      The kernel power manager has initiated a shutdown transition....

Get-WinEvent is able to render the message "Connectivity state in standby: Disconnected, Reason: NIC compliance" with no problems.

Here's the first event in event viewer with the message displayed properly as well:

the first returned event viewed in event viewer with complete message

The message suggests that the registry or event message dll file might be a problem but I've checked and they aren't:

PS U:\> Get-ItemPropertyValue HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\System\Microsoft-Windows-Kernel-Power -name EventMessageFile
C:\WINDOWS\system32\microsoft-windows-kernel-power-events.dll
PS U:\> test-path C:\WINDOWS\system32\microsoft-windows-kernel-power-events.dll
True
PS U:\> $handle = [System.IO.File]::OpenRead("C:\WINDOWS\system32\microsoft-windows-kernel-power-events.dll")
PS U:\> $handle.CanRead
True

This shows that

  1. The source is configured in the registry
  2. The file exists
  3. I can read the file

This is not isolated to the Microsoft-Windows-Kernel-Power source. The same happens for lots of other event sources. But not all event sources. For example Get-EventLog renders the Microsoft-Windows-Winlogon source messages properly:

PS U:\> Get-EventLog -LogName System -Source Microsoft-Windows-Winlogon | select -first 1 | ft

   Index Time          EntryType   Source                 InstanceID Message
   ----- ----          ---------   ------                 ---------- -------
   12100 Apr 02 13:58  Information Microsoft-Windows...         7001 User Logon Notification for Customer Experience Improvement P...

I've already restarted my machine multiple times and I ran the System File Checker and it reported no problems.

Version details:

PS U:\> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.17763.316
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.17763.316
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
3

I believe you are running into a limitation with the Get-EventLog cmdlet which has been superseded by the Get-WinEvent cmdlet. According to the official documentation:

PowerShell cmdlets that contain the EventLog noun work only on Windows classic event logs such as Application, System, or Security. To get logs that use the Windows Event Log technology in Windows Vista and later Windows versions, use Get-WinEvent.

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1

Although you are querying the System event log which should technically not be affected by this since it is a classic event log, those type of event log entries (that start with Microsoft-Windows-) only started appearing in Vista and later, so I'm pretty sure this is "by design".

I'm honestly not sure why you're not just using the Get-WinEvent cmdlet instead, since that one does work.

| improve this answer | |
  • I did switch to using Get-WinEvent to get work done. Posted here because the Get-EventLog output didn't seem right since I was querying the "classic" System log. Their documentation is missing an explanation that the *EventLog cmdlets only work on "classic sources" in "classic" logs. And an explanation to expect missing descriptions for modern logs or sources. – benrifkah Apr 4 '19 at 17:32
  • Well, just another issue with Microsoft's documentation. If you have a github account then you can send them feedback. – Lucky Luke Apr 4 '19 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.